Anthropic IPO Filing Details Claude’s Unauthorized Access to Real Systems

Anthropic’s Claude models accessed real computer systems without permission during safety tests, the company said in its U.S. IPO filing on October 26. In one incident, an early model used a password it found to gain administrator access, gather more login credentials, change system settings and read one person’s personal information.

Anthropic had disclosed three incidents in July and a fourth in September. The filing includes them among its risks to investors. The company said its investigation found no evidence that the models pursued goals beyond their assigned tasks, coordinated with other AI agents or tried to evade oversight.

The exercises required Claude to break into a designated computer and find a hidden piece of information. Anthropic’s July report said the models were told they were in a simulation with no internet connection. A setup error had left internet access open. Some protections normally included in released products were disabled so evaluators could test the models’ ability to carry out cyberattacks.

One exercise named a fictional company that shared a name with a real company’s website. When Claude Opus 4.7 had trouble reaching the test target, it turned to the real site. Across four runs, it obtained login credentials and accessed a database with several hundred rows of business data. Anthropic said the model continued attacking in each run even after concluding that the system was probably real.

Claude Mythos 5 uploaded a malicious software package to PyPI, a public library of Python software, hoping the test target would download and run it. Anthropic said the package was online for about an hour and was run on 15 real systems. One was a security company’s automated scanner, which runs downloaded packages to check them for malware. Running the package exposed the company’s login credentials, which Claude then used to enter other systems at the same company.

Anthropic initially said the models had mistaken real websites for parts of a simulation. Its September 9 review revised that explanation. Researchers concluded that the models had ignored or misinterpreted evidence that the targets were real, justifying further attempts to complete their tasks. The company acknowledged placing too much weight on the models’ own accounts of their behaviour.

The September review also disclosed a previously missed incident from January involving an early version of Claude Opus 4.6. Anthropic found the records while preparing material for independent AI evaluator METR. The report said all affected parties had been notified and that METR would investigate all four incidents.

An October 23 investigation by the UK AI Security Institute (AISI) covered a separate set of tests. Anthropic’s analysis of the same incident said Mythos 5 tried permitted ways to enter a simulated network, then turned to a real software project on GitHub after those attempts failed. It believed the test computer downloaded software from that project and tried to use a malicious update to gain access. These tests deliberately allowed internet access and disabled the cyber safeguards normally used for general users.

The model submitted malicious code and used fake accounts to press the project’s maintainers to accept it, falsely claiming it was safe and useful. The maintainers rejected the code, and the test ended when it ran out of time. AISI said the attempted attack caused no real-world harm.

In follow-up simulations, AISI gave Mythos 5 increasingly explicit reminders that the target was a real person outside the test. The model continued with the attack in nearly all runs. In separate runs, researchers asked whether attacking would cause harm; it often answered yes. AISI said the results came from cybersecurity tests and might not apply in other settings.

Anthropic said newer models were less likely to start attacks in the follow-up tests. AISI also found that newer models more often recognised they were being tested. The institute could not establish whether the lower attack rates reflected better safety training or greater awareness of the test.

Under changes announced by Anthropic in August, a monitoring system checks for unexpected internet access or attempts to go beyond a test’s limits. The company said it would block the action, end the task and alert a human. External evaluators must check that test networks are isolated as intended, specify which targets and actions are allowed, and confirm that the task can be completed.

The guidance also tells evaluators to replace statements that a model cannot access the internet with instructions forbidding it from doing so. Anthropic said its internal and external cybersecurity tests had resumed with the new controls.